[dependabot]

Bumps the version-all group with 9 updates:

Package	From	To
authlib	1.9.2	1.9.3
e2b	2.62.0	2.62.1
joserfc	1.7.7	1.8.0
json-repair	0.64.3	0.64.4
posthog	7.82.2	7.83.1
psycopg[binary,pool]	3.3.6	3.3.7
python-socketio	5.18.0	5.18.1
resend	2.50.1	2.51.0
sqlalchemy[asyncio]	2.1.6	2.1.7

Updates authlib from 1.9.2 to 1.9.3

Release notes

Sourced from authlib's releases.

v1.9.3

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-3

Full Changelog: authlib/authlib@v1.9.2...v1.9.3

Commits

• e90d1b1 chore: release 1.9.3
• ec4c7a1 Merge commit from fork
• See full diff in compare view

Updates e2b from 2.62.0 to 2.62.1

Commits

• fd72526 [skip ci] Release new versions
• 6c349d9 chore(deps): drop unused devDependencies and migrate to @​cloudflare/vitest-pl...
• 36258c1 fix(js-sdk): accept Uint8Array in file uploads (#2050)
• ac0727b fix(code-interpreter): use backend timestamp in JS OutputMessage (#2077)
• 29c0671 chore(python-sdk): bump datamodel-code-generator to 0.87.0 (#2078)
• f536bde chore(sdk): drop unused internal exports (#2033)
• 9aea608 chore(python-sdk): share sync stream_input body between commands and pty (#2038)
• 320f39d chore(deps): bump the npm_and_yarn group across 2 directories with 1 update (...
• 8e37561 chore(deps): scheduled patch/minor dependency updates for js-sdk / cli / pyth...
• f95e4ac chore(js-sdk): drop unused envd api type re-export, unexport Branded, merge d...
• Additional commits viewable in compare view

Updates joserfc from 1.7.7 to 1.8.0

Release notes

Sourced from joserfc's releases.

1.8.0

   🐞 Bug Fixes

• Use python>=3.11, improve type hints  -  by @​lepture (7c6de)
• Replace typing as t syntax  -  by @​lepture (7422a)
• Treat claims option "value" as the expected claim value  -  by @​choksi2212 (232d6)
• jwe: Refresh ECDH ephemeral keys per encryption  -  by @​lepture (cc6ec)
• jwe: Reject explicitly empty AAD  -  by @​lepture (96ef5)
• jwk: Reject certificates and prefixed public keys as oct  -  by @​lepture (bf664)
• jws: Protect critical JSON headers and b64 mode  -  by @​lepture (04cb5)
• jwt: Reject tokens whose exp equals the current time  -  by @​carlok and Claude Sonnet 5.5 (e2e3a)
• jwt: Reject NaN and Infinity in exp, nbf and iat  -  by @​carlok and Claude Sonnet 5.5 (b8a23)
• jwt: Reject True/False in exp/nbf/iat  -  by @​lepture (953e5)
• mypy: Use NotRequired in TypedDict  -  by @​lepture (351c1)

    View changes on GitHub

Changelog

Sourced from joserfc's changelog.

1.8.0

Released on November 3, 2026

• JWT: Reject non-finite and boolean NumericDate claims, and reject JWT payloads that are not JSON objects.
• JWK: Reject X.509 certificates and prefixed asymmetric public keys as oct keys.
• JWS: Require critical headers and RFC 7797 b64 parameters to be protected, and require a consistent b64 value across General JSON signatures.
• JWE: Generate fresh ECDH ephemeral keys for each encryption and reject an explicitly empty AAD member.
• Drop Python 3.10 support; Python 3.11 or newer is required.
• Preserve key subclasses in factory return types with typing.Self.
• Improve claim validation type narrowing with typing.TypeGuard and refine password, native key, and equality annotations.

Commits

• f345ff7 chore: release 1.8.0
• f1a3e43 chore: update deps
• 96ef53a fix(jwe): reject explicitly empty AAD
• cc6ec3f fix(jwe): refresh ECDH ephemeral keys per encryption
• 04cb5d8 fix(jws): protect critical JSON headers and b64 mode
• bf66415 fix(jwk): reject certificates and prefixed public keys as oct
• 953e509 fix(jwt): reject True/False in exp/nbf/iat
• 6ec88f2 Merge pull request #109 from carlok/fix/exp-boundary
• b8a2394 fix(jwt): reject NaN and Infinity in exp, nbf and iat
• e2e3a29 fix(jwt): reject tokens whose exp equals the current time
• Additional commits viewable in compare view

Updates json-repair from 0.64.3 to 0.64.4

Release notes

Sourced from json-repair's releases.

Release 0.64.4

Fixed

• Fix #245, fix a performance issue when managing long escaped strings. Thanks to @​den-run-ai for the proposed fix.

Support this project

json_repair is maintained as a side project and stays free for everyone.

If it saves you debugging time, helps you handle LLM-generated JSON, or is part of your production workflow, please consider:

• starring the repository to help more developers find it
• sharing it with teams working with unreliable JSON output
• sponsoring the project here: https://github.com/sponsors/mangiucugna

Sponsorship helps justify the time spent fixing edge cases, improving performance, and keeping the library reliable.

Commits

• 53810b5 Fix #245, fix a performance issue when managing long escaped strings. Thanks ...
• 078fc8c reduce AGENTS.md
• c21fb19 set dev group to 3.13 to solve some security issues with unmaintained packages
• 476e73e add a few new rules in Ruff and autofix
• See full diff in compare view

Updates posthog from 7.82.2 to 7.83.1

Release notes

Sourced from posthog's releases.

posthog-v7.83.1

Patch changes

• 0c12ca1 PostHogMCP.prepare_tool_list now adds the context argument to MCP SDK 2.x Tool objects. It only added it to dicts and 1.x Tool objects before, so $mcp_intent was never captured for 2.x tool objects. — Thanks @​connor-grady!

posthog-v7.83.0

Minor changes

• e094dc5 Request /flags?v=4 and read each flag's typed value, reason and metadata. They stay internal for now: this release adds no public methods, fields or types for them, and repr, equality and dataclasses.asdict of a flag show only its existing fields. Servers that still send the older response keep working, and a flag record with a field of the wrong JSON type fails only that flag. For valid flag records, existing getters, callbacks and $feature_flag_called properties return the same values as before: a number or object value reads as True, with the value as its payload. Two things can differ: the human-readable reason text of a config version 2 flag is the one the server sends at v4, and a record with a known field of the wrong JSON type (for example a string reason) now reads as a failed flag instead of being read anyway or failing the whole response. The SDK logs once per client when a server sends a response without typed values. FlagMetadata.id and FlagMetadata.version are None when a record has none, instead of 0, so their type is now Optional[int]. — Thanks @​andehen!

Commits

• 9f5d458 chore: Release v7.83.1 [skip ci]
• 0c12ca1 fix(mcp): inject context into mcp 2.x tool objects and test without fastmcp (...
• 314fad0 Update generated references
• 43c7545 chore: Release v7.83.0 [skip ci]
• e094dc5 feat(flags): read the /flags?v=4 response (#1031)
• 1dfca27 Update generated references
• See full diff in compare view

Updates psycopg[binary,pool] from 3.3.6 to 3.3.7

Changelog

Sourced from psycopg[binary,pool]'s changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.9 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

• Use the C implementation of the wait functions on Windows too. It was disabled because of an excessive CPU usage, fixed in Psycopg 3.2.11 (:ticket:[#645](https://github.com/psycopg/psycopg/issues/645)).
• Close the connection if the query cancellation following a Ctrl-C or a task cancellation is interrupted again, instead of leaving it stuck in ACTIVE state (:ticket:[#1435](https://github.com/psycopg/psycopg/issues/1435)).
• Limit the memory used by :sql:COPY FROM if the server consumes data slower than it is produced. Add a !flush_threshold parameter to ~copy.LibpqWriter to tune it (:ticket:[#1437](https://github.com/psycopg/psycopg/issues/1437)).
• Don't wait on the event loop when the socket is already writable, which made pipeline mode, ~AsyncCursor.executemany() and ~AsyncCopy.write() on async connections several times slower than on sync ones (:ticket:[#1468](https://github.com/psycopg/psycopg/issues/1468)).
• Fix client-side quoting of negative zero floats and decimals, which could produce a -- SQL comment (:ticket:[#1480](https://github.com/psycopg/psycopg/issues/1480)).
• Raise DataError instead of !ValueError registering a composite whose name or attributes are not valid namedtuple names, for instance Python keywords (:ticket:[#1482](https://github.com/psycopg/psycopg/issues/1482)).
• Speed up the C implementation of the sync wait function, in particular when the connection doesn't need to wait, for instance at every ~Copy.write() (:ticket:[#1484](https://github.com/psycopg/psycopg/issues/1484)).
• Don't replace the exception raised in a :sql:COPY block, for instance an interruption, with an error terminating the operation (:ticket:[#1486](https://github.com/psycopg/psycopg/issues/1486)).
• Fix ~copy.QueuedLibpqWriter hanging forever, instead of raising the error, if sending data to the server fails while its queue is full (:ticket:[#1489](https://github.com/psycopg/psycopg/issues/1489)).
• Performance improvements to lists dumping (:tickets:[#1490](https://github.com/psycopg/psycopg/issues/1490), [#1491](https://github.com/psycopg/psycopg/issues/1491)).
• Reduce the size of the binary packages.

Current release

Psycopg 3.3.8 ^^^^^^^^^^^^^

... (truncated)

Commits

• 4daf632 chore: bump psycopg package version to 3.3.7
• 7ce93bb chore(deps): bump pypa/cibuildwheel
• 70dce7a test: run three assertions trapped after the expected exception
• 845a06b Merge pull request #1450 from Rahul-cs50/fix/1449-register-composite-leaks-ad...
• ac2e3bb test: add and use get_objects() to GCFixture
• c62b9eb fix(composite): don't leak adapters registering a composite repeatedly
• 0e7049f docs: mention resolution of ticket #1462 in news file
• e1fc504 Merge pull request #1443 from spicysharkco/fix/array-dumper-cycles
• 0ad38b9 fix: don't create reference cycles dumping lists as arrays
• 2acfd91 Merge pull request #1465 from dvarrazzo/crdb-whitespace-issue-176211
• Additional commits viewable in compare view

Updates python-socketio from 5.18.0 to 5.18.1

Commits

• See full diff in compare view

Updates resend from 2.50.1 to 2.51.0

Release notes

Sourced from resend's releases.

v2.51.0

What's Changed

• feat(inboxes): accept path attachments on drafts by @​dielduarte in resend/resend-python#308

Full Changelog: resend/resend-python@v2.50.1...v2.51.0

Commits

• ed11cd0 feat(inboxes): accept path attachments on drafts (#308)
• See full diff in compare view

Updates sqlalchemy[asyncio] from 2.1.6 to 2.1.7

Release notes

Sourced from sqlalchemy[asyncio]'s releases.

2.1.7

Released: November 3, 2026

orm

• [orm] [feature] Added _orm.SessionTransaction.connections and _orm.SessionTransaction.bound_connection(), which return the connections a _orm.SessionTransaction has already acquired, without acquiring a new one. This allows, for example, checking whether any connection in the transaction has been invalidated before emitting further SQL. A SAVEPOINT transaction returned by _orm.Session.begin_nested() reports only the connections used within that SAVEPOINT; the root transaction returned by _orm.Session.get_transaction() reports all connections. The same accessors are available on _asyncio.AsyncSessionTransaction, returning _asyncio.AsyncConnection objects. Pull request courtesy Artur Shiriev.

  References: #13685

• [orm] [bug] An informative InvalidRequestError is now raised when more than one PropComparator.of_type() loader option is applied along the same relationship using targets of differing classes, such as two _orm.aliased() constructs against different subclasses, which previously failed with a bare AssertionError during compilation. These options can't be combined since each target brings its own aliased copy of the base table; to load multiple subclasses along a single relationship, a single _orm.with_polymorphic() object that includes all of the target classes should be used.

  This change is also backported to: 2.0.56

  References: #13751

• [orm] [bug] Fixed issue where criteria applied to a relationship using PropComparator.and_() within _orm.selectinload() or _orm.lazyload() would not be parenthesized against the relationship's join condition when the enclosing statement was retrieved from the compiled cache, so that criteria consisting of an _sql.or_() would render as a = ? AND b = ? OR c = ?. For _orm.lazyload(), this could load rows belonging to other parents into the collection. The issue typically appeared as a race condition in multithreaded applications, but could also occur within a single thread depending on the order in which statements were executed.

  This change is also backported to: 2.0.56

  References: #13753

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.